A Cross‑Site Request Forgery flaw in Terence D.'s Go To Top plugin permits an attacker to inject malicious JavaScript into the site’s stored data. When the vulnerable request is executed, the malicious script becomes part of the site content and runs in the browsers of visitors. The vulnerability is a stored XSS, identified as CWE‑352, and can be used to hijack user sessions, steal credentials, deface the site, or redirect users to phishing pages. The impact is limited to the browser context of visits to the affected WordPress installation, but it can affect all users of the site.

The Go To Top plugin from Terence D., versions n/a through <= 0.0.8, is affected. All WordPress sites installing any of these versions are at risk.

The CVSS score of 7.1 classifies the flaw as a Medium severity risk. The EPSS score of 0.00082 indicates an extremely low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an attacker tricking users into visiting a specially crafted link or, if already authenticated, submitting the malicious payload. The stored script will then be served to every site visitor, allowing widespread impact across the affected installation.